Easy setup: Container-less Tailscale as reverse proxy #6817
Replies: 20 comments 65 replies
-
|
Thanks a lot for this great guide @Perseus333 😊 FYI: you could link to the compose file directly like so for example: https://raw.githubusercontent.com/nextcloud/all-in-one/refs/heads/main/compose.yaml |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the guideline. I have an issue during submitting the domain name of Nextcloud during the wizard setup.
Note:
Is this something that can be fixed? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I've tried to follow this guide. I reach step 3 and receive the message: I checked my router and tried to open port 443 but it says the external port is already being used (which is true - I have it enabled for another server which runs immich). How can I proceed? Thanks, Leon |
Beta Was this translation helpful? Give feedback.
-
|
Thank you. This guide helped a lot. I went with option B and installed TsDProxy which was relatively easy and works great. Awesome stuff! 🙏 |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I followed this guide with Option A, but when i get to the domain validation i get this error: The logs show Tailscale serve status shows its pointing corretly, and when i use dig on my domain i get the correct ip. the only difference in my compose file is that i added: As suggested above to avoid another error i was getting when validating the domain. Any idea why i would be getting this error? Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
I have really trouble getting this to work. I am using I tried to find anything obvious going through the debugging steps but I could find anything. https and magic dns are active for my tailnet (I am using that successfully for other machines) |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for this guide, it helped me a lot! I ran into some issues though:
If anyone is interested here is a repo with my compose.yaml and the PR with every change I made to the default compose.yaml from the NextCloud repo Hopefully that helps! |
Beta Was this translation helpful? Give feedback.
-
|
I tried to open a .docx which failed. Does this setup for Option A allow Collabora to work properly or did I do something wrong? "Document loading failed ChatGPT is telling me tailscale serve struggles with websockets and I should set up caddy instead since I also want to run immich. Thoughts? |
Beta Was this translation helpful? Give feedback.
-
|
I have followed the guide and decided on using the option B: Tailscale Docker Proxy, as it allows me to assign a name to my Nextcloud container. However, I have an issue connecting to a Nextcloud container using a Tailscale IP address. When I connect to it using the ports 80 and 443, I receive the Connecting directly to my Nextcloud instance at port 8080, however, works with a self-signed certificate, but given the Nextcloud's requirement for a domain, it's impractical to have such a setup. Had anyone also had a similar issue? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I've been trying for about 2 hours to get this to work on my NAS but no matter what I try I always get this error when trying Submit my tailscale domain name The log seems to be missing some information because it outputs this: I'm using tsdproxy. I've used it with many other containers with no issues so I don't know why it's not working with nextcloud. Things I've tried:
labels:
tsdproxy.enable: "true"
tsdproxy.scheme: "https"
tsdproxy.name: "nextcloud"
tsdproxy.container_port: "11000"
tsdproxy.ephemeral: "false"
I have no idea what else to try. I have 14 other containers all working perfectly in TSDProxy so I don't understand why Nextcloud won't work. Any help would be greatly appreciated! |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I am running into the issue.. when i put in the web address i got from the third step doing Im not sure where to go from here. I feel like I am super close to getting this working but i cant get past this damn AIO page. I should also say i am running immich also. But i looked at the ports of both emby and immich and im not seeing any ports that would conflict. Any input would be greatly appreciated. |
Beta Was this translation helpful? Give feedback.
-
|
Hi Perseus333, thank you very much for your guide. I was able to solve these issues by commenting out ports #80 and #8443 in the docker_compose file. I hope this helps. |
Beta Was this translation helpful? Give feedback.
-
|
I think I know why the tailscale domain isn't reachable for some case. This is due to subtle difference between [1] tailscale serve --bg http://127.0.0.1:11000and [2] tailscale serve --service=svc:nextcloud http://127.0.0.1:11000The [1] is proposed in this guide and tailscale supports self-referencing in this mode. E.g. one can do The [2] is more versatile, as it proposes a new domain name for a service, which is good for running multiple things on the same host. Unfortunately I don't know how to solve it. It seems a deliberate design of service domain names from tailscale. |
Beta Was this translation helpful? Give feedback.
-
|
Hy @Perseus333, I set it up according to your instruction but with Tailscale funnel. Means the nextcloud is available on the public internet not just within your tailscale network. Works fine also. Also the collabora nextcloud office is working. thanks and all the best. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the guide, really simple and straightforward compared to the previous solution! Is there a reason the provided service is a Also, there is no need to spawn an entire bash shell, just the command would work: |
Beta Was this translation helpful? Give feedback.
-
Hi @Perseus333 I thought a bit about this section and I think dns should always be configured globally for all containers to use the 100.100.100.100 upstream dns server by following https://dockerlabs.collabnix.com/intermediate/networking/Configuring_DNS.html#:~:text=configure%20dns%20for%20all%20containers. Otherwise dns resolving will not work correvtly afaik. |
Beta Was this translation helpful? Give feedback.
-
|
Hi everyone, I've been trying to migrate my setup from cloudflare tunnel to tailscale. I followed through all the steps and managed to get the local address to work in my machine. However, when I start up my containers. The nextcloud container continuously restarts with a vague error in the logs: Here's a list of what I tried so far:
this is my docker-compose file: Is there anything that is missing from my end or am I running around in circles with this? |
Beta Was this translation helpful? Give feedback.
-
|
Hello, The person in this video |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thanks so much for this guide - I had previously tried different approaches and had a lot of problems. I followed this guide and everything works great, thank you! For some possibly useful context for others this is a Ubuntu 24.04 VM hosted on a Proxmox server. All features enabled and working, including community apps. |
Beta Was this translation helpful? Give feedback.




Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Easily set up Nextcloud AIO docker container and serve it through a system-wide (non-containerized) Tailscale instance. An alternative to #5439
Motivation
This guide was created out of frustration for the lack of any general, simple, well documented guide for this setup. The most referenced one 1, formerly even in the official docs, complicates the process by containerizing Tailscale. While professional, it adds a lot of unnecessary complexity and potential errors that are avoidable for most users.
Note
If you encounter any issues during the process, you can find a troubleshooting section at the end with instructions for debugging.
1. Configuring Tailscale Account
You will need to have a Tailnet already set up, and Tailscale installed and running on both your client and your server. For a quick intro, see: Tailscale quickstart (tailscale.com)
Once you have your Tailscale set up both on your server and your client, you need to enable the following configs in Tailscale from the DNS Tab (tailscale.com):
2. Installing Nextcloud AIO
Copy the contents from the default compose.yaml - Nextcloud AIO (github.com).
On your server, go to the directory where you will configure the Nextcloud AIO container and create a docker compose file (e.g.:
~/docker/nextcloud/compose.yaml). In there, paste the contents of thecompose.yamlfrom their GitHub.Inside that file, add the proper DNS resolvers, and uncomment the environment section and the two properties shown below.
In the
compose.yamldirectory, run the container with:3. Setting up a domain
Nextcloud will require a proper domain with HTTPS. You can serve a domain from your machine serve using the following command. Notice the
http://.If you're running Systemd it is a good idea to set this as a service on startup, so create the service by pasting the following content into
/etc/systemd/system/tailscale-serve-nextcloud.service:And enable it and check that it's running
4. Nextcloud Setup Wizard
On your client, which should be running Tailscale and having its DNS at
100.100.100.100(or any other valid Tailscale IP). Open your browser and open the Tailscale IP address of your server followed by port 8080. Also do not forget to prependhttps://. E.g.:https://100.123.145.67:8080. You can get its IP from the Tailscale dashboard (tailscale.com) and choosing the one that corresponds with the machine that is running the container.Tip
resolvectl statusfrom the client, you should see Tailscale with "Default Route" as yes.You should arrive at the Nextcloud setup page, there follow the Nextcloud instructions:
Tip
If you want to use a custom Tailscale domain name, change it before submitting the domain on Nextcloud. Otherwise things will break, and you might be better off restarting the Nextcloud containers from scratch. You can change it by clicking the "Rename Tailnet" button at DNS (tailscale.com)
It will ask you for the domain of your server, the domain will be the one that we have set up earlier.
If you can get it from:
Alternatively, regardless of what you used, it will be visible via the Tailscale Dashboard (tailscale.com). Click on the IP address, and copy the one that is formatted like:
name.tail0a12b3.ts.net, then paste it on the domain field.Note
The Tailscale domain is a very convenient way of having a certified HTTPS domain that only you can access. We need to use a domain since Nextcloud requires it.
Afterwards, continue the setup wizard: select your desired containers, set up the TZ, the backup location, and finally "Download and start containers".
Once that finishes setting up, try opening the domain that you configured Nextcloud to run on in your web browser, and you should see yourself in the login page!
Troubleshooting
docker logs CONTAINERmight show some errorsIf you're having connectivity issues check:
docker psfor docker exposed portsss -tlnpfor seeing which ports are being usedtailscale statusboth on client and server (just in case)tailscale serve statusfrom the serverdig DOMAINto see if the DNS resolves the domaincurl -v ADRESSfrom both client and server. (add-kflag in case you're dealing with https issues)If you experience issues with Collabora, specifically a CODE related error, try disabling ports 80 and 8443 from the docker compose.
Thanks to @ilblasco78 for the solution in their comment
For issues related to port 443 not being reachable, try modifying the docker compose file as suggested by @faustus1005 in their comment:
APACHE_IP_BINDINGto 0.0.0.0SKIP_DOMAIN_VALIDATION=true, note that this is a last resort solution.curlworks both from the client and the server, check that your browser isn't overwriting your DNS and uses the system default.Footnotes
Tailscale (and Caddy as a sidecar) Reverse Proxy #5439 (github.com) ↩
Beta Was this translation helpful? Give feedback.
All reactions